SSA-348662 — SSA-348662: Multiple Vulnerabilities in SIMATIC MV500 Devices before V3.3

Summary

SIMATIC MV500 devices before V3.3 are affected by multiple vulnerabilities that could allow attackers to hijack other users' web based management sessions (CVE-2022-33137) or access data on the device without prior authentication (CVE-2022-33138).

Siemens has released an update for the SIMATIC MV500 devices and recommends to update to the latest version. Note that the update also contains additional fixes for vulnerabilities documented in Siemens Security Advisory SSA-712929.

Vulnerabilities 2

Unscored —

CVE-2022-33137

A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SI…

Siemens SIMATIC MV560 X SIMATIC MV540 H SIMATIC MV550 H ICS / OT

Jul 12, 2022
Unscored —

CVE-2022-33138

A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SI…

Siemens SIMATIC MV560 U SIMATIC MV540 S SIMATIC MV550 S ICS / OT

Jul 12, 2022

Revision history

2022-07-12 #1
Publication Date

References

SSA-348662: Multiple Vulnerabilities in SIMATIC MV500 Devices before V3.3 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-348662.pdf
SSA-348662: Multiple Vulnerabilities in SIMATIC MV500 Devices before V3.3 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-348662.txt